Windows Command Shell

Attackers run commands through cmd.exe, the Windows command shell, to start programs, run batch scripts and chain built-in tools together. It is a sub-technique of Command and Scripting Interpreter, under the Execution tactic. Almost every Windows intrusion uses it at some point, because the shell is on every host and its commands look like ordinary administration.

An attacker who can run code on a host starts cmd.exe, often hidden and launched by another program: a document, a script host, a remote management service or a scheduled job. They pass a command with /c, chain several with & or &&, and send the output to a file to read later. Batch files let them repeat the same steps on many hosts.

Data source: Windows process creation events (Sysmon and Windows Security)

{
  "host": {
    "name": "ws-214.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "cmd.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "cmd.exe /c ver > %TEMP%\\v.txt"
  },
  "@timestamp": "2026-05-14T09:31:27.604Z"
}

Prebuilt Elastic rule: Command and Scripting Interpreter via Windows Scripts

Windows Security 4688 events include the command line only when the "Include command line in process creation events" policy is on, and values must match the case your data records (Office programs are logged in capitals). Start with shells started by programs that rarely need one: process.name: "cmd.exe" and process.parent.name: ("EXCEL.EXE" or "POWERPNT.EXE" or "wscript.exe" or "cscript.exe"). Then read the command lines of what you find. Look for commands chained with & or &&, output sent to public or temporary folders, a shell started under a service or web server account, and many short-lived shells in a burst from one parent. The prebuilt rule named on this page covers shells started by script hosts, not by Office programs, so the Office part of this hunt has no prebuilt rule behind it.

Administrators, installers, logon scripts and management agents start cmd.exe all day. Compare the parent program, the account and the command with what that host normally runs. A shell started by a document or a web server is rarely legitimate; one started by a known management agent usually is.

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

• EDR / XDR telemetry (Defender for Endpoint, CrowdStrike, SentinelOne, Elastic Defend, Endgame) (the log as a whole)
• Windows Security event log
  • 4688 A new process has been created.
• Sysmon
  • 7 Image loaded

• MITRE ATT&CK, Command and Scripting Interpreter: Windows Command Shell
• Microsoft Learn, cmd

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.